Issues (2950)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/articlepages/SMW_OrderedListPage.php (7 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
use SMW\ApplicationFactory;
4
use SMW\DIProperty;
5
use SMW\PropertyRegistry;
6
7
/**
8
 * Abstract subclass of MediaWiki's Article that handles the common tasks of
9
 * article pages for Concept and Property pages. This is mainly parameter
10
 * handling and some very basic output control.
11
 *
12
 * @ingroup SMW
13
 *
14
 * @author Nikolas Iwan
15
 * @author Markus Krötzsch
16
 * @author Jeroen De Dauw
17
 */
18
abstract class SMWOrderedListPage extends Article {
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.

You can fix this by adding a namespace to your class:

namespace YourVendor;

class YourClass { }

When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.

Loading history...
19
20
	/**
21
	 * Limit for results per page.
22
	 *
23
	 * @var integer
24
	 */
25
	protected $limit;
26
27
	/**
28
	 * Start string: print $limit results from here.
29
	 *
30
	 * @var string
31
	 */
32
	protected $from;
33
34
	/**
35
	 * End string: print $limit results strictly before this article.
36
	 *
37
	 * @var string
38
	 */
39
	protected $until;
40
41
	/**
42
	 * Cache for the current skin, obtained from $wgUser.
43
	 *
44
	 * @var Skin
45
	 */
46
	protected $skin;
47
48
	/**
49
	 * Property that the displayed values are for, if any.
50
	 *
51
	 * @since 1.6
52
	 *
53
	 * @var SMWDIProperty
54
	 */
55
	protected $mProperty = null;
56
57
	/**
58
	 * Overwrite view() from Article.php to add additional HTML to the
59
	 * output.
60
	 */
61
	public function view() {
62
		global $wgRequest, $wgUser;
0 ignored issues
show
Compatibility Best Practice introduced by
Use of global functionality is not recommended; it makes your code harder to test, and less reusable.

Instead of relying on global state, we recommend one of these alternatives:

1. Pass all data via parameters

function myFunction($a, $b) {
    // Do something
}

2. Create a class that maintains your state

class MyClass {
    private $a;
    private $b;

    public function __construct($a, $b) {
        $this->a = $a;
        $this->b = $b;
    }

    public function myFunction() {
        // Do something
    }
}
Loading history...
63
64
		$outputPage = $this->getContext()->getOutput();
65
66
		if ( !ApplicationFactory::getInstance()->getSettings()->get( 'smwgSemanticsEnabled' ) ) {
67
			$outputPage->setPageTitle( $this->getTitle()->getPrefixedText() );
68
			$outputPage->addHTML( wfMessage( 'smw-semantics-not-enabled' )->text() );
69
			return;
70
		}
71
72
		if ( $this->getTitle()->getNamespace() === SMW_NS_PROPERTY ) {
73
			$this->findBasePropertyToRedirectFor( $this->getTitle()->getText() );
74
		}
75
76
		$this->initParameters();
77
78
		if ( !isset( $diff ) || !$diffOnly ) {
0 ignored issues
show
The variable $diff seems only to be defined at a later point. As such the call to isset() seems to always evaluate to false.

This check marks calls to isset(...) or empty(...) that are found before the variable itself is defined. These will always have the same result.

This is likely the result of code being shifted around. Consider removing these calls.

Loading history...
The variable $diffOnly seems only to be defined at a later point. Did you maybe move this code here without moving the variable definition?

This error can happen if you refactor code and forget to move the variable initialization.

Let’s take a look at a simple example:

function someFunction() {
    $x = 5;
    echo $x;
}

The above code is perfectly fine. Now imagine that we re-order the statements:

function someFunction() {
    echo $x;
    $x = 5;
}

In that case, $x would be read before it is initialized. This was a very basic example, however the principle is the same for the found issue.

Loading history...
79
80
			// MW 1.25+
81
			if ( method_exists( $outputPage, 'setIndicators' ) && ( $indicators = $this->getTopIndicators() ) !== '' ) {
82
				$outputPage->setIndicators( $indicators );
83
			}
84
85
			$outputPage->addHTML( $this->getIntroductoryText() );
86
		}
87
88
		parent::view();
89
90
		// Copied from CategoryPage
91
		$diff = $wgRequest->getVal( 'diff' );
92
		$diffOnly = $wgRequest->getBool( 'diffonly', $wgUser->getOption( 'diffonly' ) );
93
		if ( !isset( $diff ) || !$diffOnly ) {
94
			$this->showList();
95
		}
96
	}
97
98
	private function findBasePropertyToRedirectFor( $label ) {
99
100
		$property = new DIProperty(
101
			PropertyRegistry::getInstance()->findPropertyIdByLabel( $label )
102
		);
103
104
		// Ensure to redirect to `Property:Modification date` and not using
105
		// a possible user contextualized version such as `Property:Date de modification`
106
		$canonicalLabel = $property->getCanonicalLabel();
107
108
		if ( $canonicalLabel !== '' && $label !== $canonicalLabel ) {
109
			$outputPage = $this->getContext()->getOutput();
110
			$outputPage->redirect( $property->getCanonicalDiWikiPage()->getTitle()->getFullURL() );
111
		}
112
	}
113
114
	/**
115
	 * @since 2.4
116
	 *
117
	 * @return string
118
	 */
119
	protected function getTopIndicators() {
120
		return '';
121
	}
122
123
	/**
124
	 * @since 2.4
125
	 *
126
	 * @return string
127
	 */
128
	protected function getIntroductoryText() {
129
		return '';
130
	}
131
132
	/**
133
	 * @since 2.4
134
	 */
135
	protected function getNavigationLinks( $msgKey, array $diWikiPages, $default = 50 ) {
136
		global $wgRequest;
0 ignored issues
show
Compatibility Best Practice introduced by
Use of global functionality is not recommended; it makes your code harder to test, and less reusable.

Instead of relying on global state, we recommend one of these alternatives:

1. Pass all data via parameters

function myFunction($a, $b) {
    // Do something
}

2. Create a class that maintains your state

class MyClass {
    private $a;
    private $b;

    public function __construct($a, $b) {
        $this->a = $a;
        $this->b = $b;
    }

    public function myFunction() {
        // Do something
    }
}
Loading history...
137
138
		$mwCollaboratorFactory = ApplicationFactory::getInstance()->newMwCollaboratorFactory();
139
140
		$messageBuilder = $mwCollaboratorFactory->newMessageBuilder(
141
			$this->getContext()->getLanguage()
142
		);
143
144
		$title = $this->mTitle;
145
		$title->setFragment( '#SMWResults' ); // Make navigation point to the result list.
146
147
		$resultCount = count( $diWikiPages );
148
		$navigation = '';
149
150
		if ( $resultCount > 0 ) {
151
			$navigation = $messageBuilder->prevNextToText(
152
				$title,
153
				$wgRequest->getVal( 'limit', $default ),
154
				$wgRequest->getVal( 'offset', '0' ),
155
				array(
156
					'value'  => $wgRequest->getVal( 'value', '' ),
157
					'from'   => $wgRequest->getVal( 'from', '' ),
158
					'until'  => $wgRequest->getVal( 'until', '' )
159
				),
160
				$resultCount < $wgRequest->getVal( 'limit', $default )
161
			);
162
163
			$navigation = Html::rawElement('div', array(), $navigation );
164
		}
165
166
		return Html::rawElement(
167
			'p',
168
			array(),
169
			Html::element( 'span', array(), wfMessage( $msgKey, $resultCount )->parse() ) . '<br>' .
170
			$navigation
171
		);
172
	}
173
174
	/**
175
	 * Main method for adding all additional HTML to the output stream.
176
	 */
177
	protected function showList() {
178
		global $wgOut, $wgRequest;
0 ignored issues
show
Compatibility Best Practice introduced by
Use of global functionality is not recommended; it makes your code harder to test, and less reusable.

Instead of relying on global state, we recommend one of these alternatives:

1. Pass all data via parameters

function myFunction($a, $b) {
    // Do something
}

2. Create a class that maintains your state

class MyClass {
    private $a;
    private $b;

    public function __construct($a, $b) {
        $this->a = $a;
        $this->b = $b;
    }

    public function myFunction() {
        // Do something
    }
}
Loading history...
179
180
181
		$this->from = $wgRequest->getVal( 'from', '' );
182
		$this->until = $wgRequest->getVal( 'until', '' );
183
184
		if ( $this->initParameters() ) {
185
			$wgOut->addHTML( $this->getHtml() );
186
			SMWOutputs::commitToOutputPage( $wgOut );
187
		}
188
189
	}
190
191
	/**
192
	 * Initialise some parameters that might be changed by subclasses
193
	 * (e.g. $limit). Method can be overwritten in this case.
194
	 * If the method returns false, nothing will be printed besides
195
	 * the original article.
196
	 *
197
	 * @return true
198
	 */
199
	protected function initParameters() {
200
		$this->limit = 20;
201
		return true;
202
	}
203
204
	/**
205
	 * Returns the HTML which is added to $wgOut after the article text.
206
	 *
207
	 * @return string
208
	 */
209
	protected abstract function getHtml();
0 ignored issues
show
The abstract declaration must precede the visibility declaration
Loading history...
210
211
	/**
212
	 * Like Article's getTitle(), but returning a suitable SMWDIWikiPage.
213
	 *
214
	 * @since 1.6
215
	 *
216
	 * @return SMWDIWikiPage
217
	 */
218
	protected function getDataItem() {
219
		return SMWDIWikiPage::newFromTitle( $this->getTitle() );
220
	}
221
222
}
223